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Abstract. This paper introduces and studies a declarative framework for updat- 
ing views over indefinite databases. An indefinite database is a database with 
null values that are represented, following the standard database approach, by a 
single null constant. The paper formalizes views over such databases as indefi- 
nite deductive databases, and defines for them several classes of database repairs 
that realize view-update requests. Most notable is the class of constrained re- 
pairs. Constrained repairs change the database "minimally" and avoid making 
arbitrary commitments. They narrow down the space of alternative ways to fulfill 
the view-update request to those that are grounded, in a certain strong sense, in 
the database, the view and the view-update request. 



1 Introduction 

A typical database system is large and complex. Users and applications rarely can ac- 
cess the entire system directly. Instead, it is more common that access is granted in 
terms of a view, a virtual database consisting of relations defined by a query to the 
stored and maintained database. Querying a view does not present a conceptual prob- 
lem. In contrast, another key task, view updating, poses major challenges. 

Example 1. Let D = {q{a,b)} be a database over relation symbols q and r, where the 
relation r has arity three and is currently empty. Let us consider the view over D given by 
the Catalog program P = {p{X) ^ q{X ,Y) ,r{X ,Z)} . That view consists of a single 
unary relation p. Given the present state of D, the view is empty. 

To satisfy the request that p{a) holds in the view (as it is now, it does not), one 
needs to update the database D. Such update consists of executing update actions that 
specify facts to insert to and to delete from D. These update actions (in a simplified 
setting that we consider for now) are "signed" facts +F and — G, where +F stands 
for "insert F" and — G stands for "delete G." In our case, the set of update actions 
{—q{a,b),+q{a,a),+r{a,a,a)} is a correct update to D. Executing it on D results in 
the database D' = {q{a,a),r{a,a,a)}, which has the desired property that p{a) holds in 
the view determined by P. There are also other ways to satisfy the user's request, for 
instance: {+r{a,b,a)} and {+q{c,d),+r{c,d,d)}, where c and d are any elements of 
the domain of the database. □ 



As this example suggests, view updating consists of translating a view-update re- 
quest, that is, an update request against the view, into an update, a set of update actions 



against the stored (extensional) database. The example highlights the basic problem of 
view updating. It may be (in fact, it is common), that a view-update request can be ful- 
filled by any of a large number of database updates. One of them has to be committed to 
and executed. Thus, developing methods to automate the selection process or, at least, 
aid the user in making the choice is essential and has been one of the central problems 
of view updating [9,2,13,11]. That problem is also the focus of our paper. ' 

To restrict the space of possible database updates to select from, it is common to 
consider only those that accomplish the view-update request and are in some sense min- 
imal. That reduces the space of updates. For instance, the update {—q{a,b),+q{a,a), 
+r{a,a,a)} in Example 1 is not minimal. We can remove —q{a,b) from it and what re- 
mains is still an update that once executed ensures that p{a) holds in the view. Minimal 
updates fulfilling the view-update request are commonly called repairs. 

Even imposing minimality may still leave a large number of candidate repairs. In 
Example 1, updates {+r{a,b,y/)}, where i// is any domain element, are repairs, and 
there are still more. As long as we insist on the completeness of the repaired database, 
there is little one can do at this point but ask the user to select one. 

The situation changes if we are willing to allow indefiniteness (incomplete infor- 
mation) in databases. Given the "regular" structure of the family of repairs above, one 
could represent it by a single indefinite repair, {+r(a,^, i//)} regarding i// as a distinct 
null value standing for some unspecified domain elements. The choice facing the user 
substantially simplifies as possibly infinitely many repairs is reduced to only one. 

This approach was studied by Farre et al. [5], where the terminology of Skolem con- 
stants rather than null values was used. However, while seemingly offering a plausible 
solution to the problem of multiple repairs, the approach suffers from two drawbacks. 
First, the use of multiple Skolem constants (essentially, multiple null values) violates 
the SQL standard [15]. Second, the approach assumes that the initial database is com- 
plete (does not contain null values). Thus, while the approach might be applied once, 
iterating it fails as soon as an indefinite database is produced, since no guidance on how 
to proceed in such case is given. 

We consider the view-update problem in the setting when both the original and 
the updated databases are indefinite (may contain occurrences of null values). To be 
compliant with the SQL standard, we allow a single null value only. We denote it by _L 
and interpret it as expressing the existence of unknown values for each attribute it is used 
for [10]. Typically, a database is represented as a set of facts. We propose to represent 
indefinite databases by two sets of facts that we interpret by means of a two-level closed- 
world assumption tailored to the case of indefinite information. We interpret indefinite 
databases in terms of their possible worlds. We extend the possible-world semantics to 
the setting of views, which we formalize in terms of indefinite deductive databases, and 
apply the resulting formalism to state and study the view-updating problem. 

We then turn attention to the problem of multiple repairs. In general, using null 
values to encode multiple repairs is still not enough to eliminate them entirely (cf. our 



In some cases no update satisfies the view-update request. The question whether the lack of an 
appropriate update is caused by errors in the design of the view, in the extensional database, or 
in the view-update request is interesting and deserves attention, but is outside the scope of the 
present work. 



discussion above), and some level of the user's involvement may be necessary. There- 
fore, it is important to identify principled ways to narrow down the space of repairs for 
the user to consider As the setting we consider here, when both the original and the 
updated databases may contain null values has not been considered before, we propose 
a concept of minimality tailored precisely to that situation. The primary concern is to 
minimize the set of new constants introduced by an update. The secondary concern is to 
minimize the degree of the semantic change. The resulting notion of minimality yields 
the notion of a repair. 

Our concept of minimality leads us also to the concept of a relevant repair, an up- 
date that introduces no new constants and minimizes the degree of change. In Example 
1, {+r(fl,/7, _L)}, {+r(fl,fl, ±), +<?(«, fl)} and {+r(a,c, ±), +^(fl,c)}, where c is an el- 
ement of the database domain other than a and b, are all repairs. The first two are 
obviously relevant, the third one is not. 

Some occurrences of non-nullary constants in a relevant repair may still be "un- 
grounded" or "arbitrary," that is, replacing them with another constant results in a re- 
pair For instance, replacing in the relevant repair {+r(fl,fl,_L),+^(fl,fl)} the second 
and the forth occurrences of a with a fresh constant c yields {+r(fl,c, ±), +^(fl,c)}, an 
update that is a repair. Intuitively, "arbitrary" occurrences of constants, being replace- 
able, are not forced by the information present in the view (deductive database) and in 
the view-update request. By restricting relevant repairs to those without arbitrary oc- 
currences of constants we arrive at the class of constrained repairs. In the view-update 
problem considered in Example 1, there is only otie constrained repair, {+r{a,b, ±)}. 

Finally, we study the complexity of the problems of the existence of repairs, relevant 
repairs and constrained repairs. We obtain precise results for the first two classes and 
an upper bound on the complexity for the last class. 

To summarize, our main contributions are as follows. We propose a two-set repre- 
sentation of indefinite database that is more expressive than the standard one. We define 
the semantics and the operation of updating indefinite databases (Section 2). We define 
views over indefinite databases (indefinite deductive databases), and generalize the se- 
mantics of indefinite databases to views (Section 3). We state and study the view-update 
problem in the general setting when the initial and the repaired databases are indefinite. 
We propose a notion of minimality of an update and use it to define the concept of a 
repair. We address the problem of multiple repairs by defining relevant and constrained 
repairs (Section 4). We study the complexity of problems of existence of repairs, rele- 
vant repairs and constrained repairs (Section 5). The proofs are in the appendix. 

2 Indefinite Databases 

We consider a finite set U of relation symbols and a set Dom of constants that includes a 
designated element L, called the null value. We define Dom^i = Dom \ {-L}. Normally, 
we assume that Dom is an infinite countable set. However, for the sake of simplicity, in 
several of the examples the set Dom is finite. 

Some predicates in FI are designated as base (or extensional) predicates and all 
the remaining ones are understood as derived (or intensional) predicates. A term is a 
constant from Dom or a variable. An atom is an expression of the form p{ti,... ,tk), 
where p G 17 is a predicate symbol of arity k and /,'s are terms. An atom is ground if 



it does not contain variables. We refer to ground atoms as facts. We denote the set of 
all facts by At. We call facts defined in terms of base and derived predicates base facts 
and derived facts respectively. A fact is definite if it does not contain occurrences of _L. 
Otherwise, it is indefinite. Given a set S of atoms, we define Dom{S) (resp. Domj{S)) as 
the set of constants in Dom (resp. Dom^) occurring in S. For every two tuples of terms 
t = (?!,..., fj:) and t' = (fj,...,f[) and every ^-ary predicate symbol p G 17, we write 
t <t' and p{t) < p{t') if for every /, \ <i <k, t, ~ t'- or t, We say in such case that 
t' and p{t') are at least as informative as t and p{t), respectively. If, in addition, f 7^ r', 
we write t ^ t' and p{t) ~< p{t'), and say that t' and p{t') are more informative than t 
and p{t). Sometimes, we say "at most as informative" and "less informative," with the 
obvious understanding of the intended meaning. We also define t and t' (respectively, 
p{t) and p{t')) to be compatible, denoted by f « f' (respectively, p{t) w p{t')), if for 
some ^-tuple s of terms, t <s and t' < s. Finally, for a set D C At, we define 

{a I there is b e D s.t. a ^ b} D^= {a \ there is b e D s.t. b ^a} 
D~= {fl I there is ^ G D s.t. b ^ a} D~ 

To illustrate, let ^ be a binary relation symbol and Dom = {_L, 1 , 2}. Then: 

{<7(1,±)}* = M1,±),^(±,±)} {^(1,±)}^ = {^(1,±),^(1,1),^(1,2)} 

= M1,±),^(1,1),^(1,2),^(±,1),^(1,2),^(±,±)} 

We note also note that D~ = (D^)*. 

In the most common case, databases are finite subsets of At that contain definite 
facts only. The semantics of such databases is given by the closed-world assumption or 
CWA [12]: a definite fact q is true in a database D if q G D. Otherwise, q is false in 
D. We are interested in databases that may contain indefinite facts, too. Generalizing, 
we will for now assume that an indefinite database is a finite set of possibly indefinite 
atoms. The key question is that of the semantics of indefinite databases. 

Let D be an indefinite database. Clearly, all facts in D are true in D. In addition, any 
fact that is less informative than a fact in D is also true in D. Indeed, each such fact 
represents an existential statement, whose truth is established by the presence of a more 
informative fact in D (for instance, the meaning of p{-L) is that there is an element c 
in the domain of the database such that p{c) holds; if p{l) G D, that statement is true). 
Summarizing, every fact in is true in D. 

By CWA adapted for the setting of indefinite databases [10], facts that are not in 
Sire not true in D, as D contains no evidence to support their truth. Those facts among 
them that are compatible with facts in D (in our notation, facts in D"), might actually 
be true, but the database just does not know that. Of course, they may also be false, 
the database does not exclude that possibility either They are regarded as unknown. By 
CWA again, the facts that are not compatible with any fact in D are false in D, as D 
provides no explicit evidence otherwise. 

The simple notion of an indefinite database, while intuitive and having a clear se- 
mantics, has a drawback. It has a limited expressive power For instance, there is no 
database D to represent our knowledge that p{l) is false and that there is some definite 
c such that p{c) holds (clearly, this c is not 1). To handle such cases, we introduce a 
more general concept of an indefinite database, still using CWA to specify its meaning. 



Definition 1. An indefinite database (a database, /or short) is a pair — {D,E), where 
D and E are finite sets of (possibly indefinite) facts. □ 



The intended role of D is to represent all facts that are true in the database {D,E), 
while E is meant to represent exceptions, those facts that normally would be unknown, 
but are in fact false (and the database knows it). More formally, the semantics of indef- 
inite databases is presented in the following definition. 

Definition 2. Let {D,E) be a database and let q ^ At be a fact. Then: (1) q is true in 
{D,E), written {D,E) q, if q G D^; (2) q is unknown in {D,E), ifq G {D~ \D^)\E^ 
(=D"" \ E'^); (3) q is false in {D,E), denoted {D,E) |= ^q, in all other cases, that is, if 
q^D'^ orifqeD-^nE^. □ 

The use of E'^ in the definition (items (2) and (3)) reflects the property that if an 
atom a is false then every atom b at least as informative as a must be false, too. 

We denote the sets of all facts that are true, unknown and false in a database y = 
{D,E) by y,, J' u and J" f, respectively. Restating the definition we have: 

^„=D~\£^, and J f ^ {At\D'^)\j{D'^ r\E'^). 

Example 2. The knowledge that pic) holds for some constant c and that p{\) is false 
can be captured by the database ({/7(_L)}, {^(l)}). The database ({q'(_L,±),^(l, 1)}, 
{q{l,l-)}) specifies that the atoms q{\, 1), ^(1,_L), ^(-L, 1) and ^(±,_L) are true, that 
all definite atoms q{\^d), with c/ 7^ 1, are false, and that all other atoms q{c,d) are 
unknown. While the fact that ^(±,_L) is true follows from the fact that ^(1, 1) is true, 
the presence of the former in the database is not redundant, that is, the database without 
it would have a different meaning. Namely, q{^, -L) makes all atoms q{a,b) potentially 
unknown (with some of them true or false due to other elements of the database). □ 

Definition 3. A set W of definite /acfi is a possible world /or a database = {D,E) 
if ^ t ^ "explains" all facts that are true in c^^j, W C ^ , U (only definite 

facts that are true or unknown appear in a possible world). □ 

Databases represent sets of possible worlds. For a database ,^ , we write W{^) to 
denote the family of all possible worlds for J^. Due to the absence of indefinite facts in 
W G 'W{.y), every fact in At is either true (if it belongs to W^^) or false (otherwise) w.rt. 
W . Extending the notation we introduced earlier, for a possible world W and a G Af we 
write W \= a\f a E and W \= ^a, otherwise. The following proposition shows that 
the semantics of a database can be stated in terms of its possible worlds. 

Proposition 1. Let .y be a database and q a fact. Then q G if and only ifW \= q, 
for every W G "WiJ), and q G J f if and only ifW 1= ^q,for every W G WiJ). □ 

Updating a database {D^E) consists of executing on it update actions: inserting 
a base fact a into D or E, and deleting a base fact a from D or: E. We denote them 
by +fl^, +a^ , —a^ and — a^, respectively. For a set U of update actions, we define 
U'l^{a\ G U}, Uf = {a\ +a^ G U}, U'^^{a\ ~a° G U}, and U'^^{a\ -a^ G 
[/}. To be executable, a set U of update actions must not contain contradictory update 



actions: and ~a^, or and —a^. A contradiction-free set U of update actions 
is an update. We denote the set of all updates (in the fixed language we consider) by . 
We now define the operation to update a database, that is, to apply an update to it. 

Definition 4. Let = {D,E) be an indefinite database and U an update. We define 
J'oU as the database {D' ,E'), where D' = {DUU'^)\U^ and E' = {EUU'l)\U'^. □ 

3 Indefinite Deductive Databases 

Integrity constraints (ICs, for short) are first-order sentences in the language ^ deter- 
mined by the set of predicates FI and by the set Dom^ of definite constants. A database 
with integrity constraints is a pair {,f ,r\), where ^ is a database and 77 is a set of ICs. 
Possible worlds can be regarded as interpretations of the language ^ with Domj as 
their domain. This observation and Proposition 1 suggest a definition of the semantics 
of databases with ICs. 

Definitions. Let {J^jTj) be a database with ICs. A possible world W € W^J^) is a 
possible world for a database ifW satisfies every integrity constraint in rj. We 

denote the set of possible worlds of {.y , rj) by W{.y , Tj). A database with ICs, (^,7]), 
is consistent ifW{,J^, 77) 7^ 0. Otherwise, (^,7]) is inconsistent. 

A fact q is true in (^,7]) ifW \= q, for every W G W{.y , rj); q is false in {^,1]) if 
W \= -iq,for every W € W{.y , 7j); otherwise, q is unknown in 7j). □ 

Examples. Let us consider the database ^ = {{p(l),p{2),q{±)},(d) (there are no ex- 
ceptions) and let 77 = {\/X{q{X) p{X))}. Possible worlds of include {p{l),p{2), 
q{l)}, {p{l),p{2), q{2)} and {p{l) , p{2) , q{3)} . The first two satisfy the integrity con- 
straint, the third one does not. Thus, only the first two are possible worlds of {J^,rj). 
Since p{l) belongs to all possible worlds of {,f ,r\), p{\) is true in (^,7j). Further, 
p(3) is false in every possible world of ,f and so also in every possible world of ( J^, 7j}. 
Thus, p{'i) is false in (j^, 7j). Lastly, we note that ^(1) and q{2) are unknown in 
while q{'i) is false (due to p{3) being false and the integrity constraint). □ 

We note that the possible-world semantics can capture additional information con- 
tained in integrity constraints. In Example 3, the semantics derives that q'(3) is false in 
7j) even though this knowledge is not present in the database ^ . 

The concepts of an update and of the operation to execute an update on a database 
extend literally to the case of databases with ICs. 

Following Ullman [16], views are safe Catalog^ programs. We use the standard ter- 
minology and talk about (Catalog^) rules, and bodies and heads of rules. A rule is safe 
if each variable occurring in the head or in a negative literal in the body also occurs in a 
positive literal in the body. A Catalog^ program is safe if each rule is safe. We assume 
that views do not contain occurrences of L. The semantics of Datalog^programs is 
given in terms of answer sets [6, 7]. A precise definition of that semantics is immaterial 
to our study and so we do not provide the details. 

Definition 6. An indefinite deductive database (from now, simply, a deductive database) 
is a tuple & = r\,P), where is a database, r\ is a set of integrity constraints, and 



P is a safe Datalog^ program (the specification of a viewj such that no predicate oc- 
curring in the head of a rule in P is a base predicate. □ 

Clearly, a deductive database with the empty view is a database with ICs, and a 
deductive database with the empty view and no ICs is simply a database. 

Definition 7. A deductive database & = ,rj,P) is consistent if {J^, f]) is consistent 
and for every possible world W € ^r\), the program WiJP has answer sets. We 

denote the family of all those answer sets by W (Q)) or #'(^, TJ,P). We call elements 
o/#'(^) possible worlds o/^. □ 

There is an alternative to our concept of consistency. One could define a deductive 
database {y,ri,P) as consistent if for at least one world W E Tj), the program 

W UP has an answer set. That concept of consistency would allow situations where 
for some possible worlds of (J'^rj), one of which could be a description of the real 
world, the view P does not generate any meaningful virtual database. Our concept of 
consistency is more robust. It guarantees that the user can have a view of a database no 
matter how the real world looks like, that is, which of the possible worlds describes it. 

Example 4. Let ^ ~ ,r],P) be a deductive database, where ^ = ({p(_L)},0), 77 =0 
and P = {f <— p{l),p{2),not t}, for some derived ground atom t. Every non-empty set 
W C {p{u) I u G Doniii) is a possible world of {,f ,r\). In particular, the set {p{l),p{2)] 
is a possible world of {,f , rj). Since the program PU{/7(1),/:' (2)} has no answer sets, & 
is inconsistent (according to our definition). If = {J^ , {p{l) A p{2) — _L},P), then 
the integrity constraint in i^' eliminates the offending possible world and one can check 
that for every possible world W of (j^, {/?(!) A p{2) -> _L}), PUW has an answer set. 
Thus, fF' is consistent.^ □ 

The concept of an update extends in a natural way to deductive databases. If U is 
an update, and = {,f ,r\,P), we define the result of updating S! hy U hy 2> oU = 

{jou,n,p). 

Next, we define the semantics of a deductive database ^ = {j^,ri,P), again building 
on the characterization given by Proposition 1 . 

Definition 8. A fact a G At is true in a deductive database ^ = , "HtP)' denoted by 
S> \= a, if for every possible world W 6 W \= a; a is false in denoted by 

Si \= -la, if for every W G W{Si), W \= ^a; a is unknown in '3, otherwise. We denote 
the truth value of a in '3 by VQiia). □ 

Example 5. Let Dom ~ {±,1,2,3} and Si ~ {J'jTjjP) be a deductive database, where 
y = ({/^(±)},0), 7? - {p{2) ^ ±} and P = {qiX) ^ p{X)}. 

We have #^(^,77) = {{p(l)},{p(3)}, {/9(l),p(3)}}. Each of the possible worlds 
in W{J^,rj), when extended with the view P, gives rise to a program that has an- 
swer sets. Thus, S is consistent. Moreover, the possible worlds for S are {p{l),q{l)}, 
{p{3),q{3)} and {p{l),q{l),p{3),q{3)} (in this case, one for each possible world 
in W{J^,ri)). It follows that p(-L) and q{^) are true, p{2) and q{2) are false, and 
p{l),q{l),p{3) and ^(3) are unknown in S. □ 

- We point out that in the paper, we overload the notation _L. We use it to denote both the single 
null value in the language and the falsity symbol in the first-order language used for integrity 
constraints. Since the meaning is always clear from the context, no ambiguity arises. 



4 View Updating 



In the view update problem, the user specifies a request, a Hst of facts the user learned 
(observed) to be true or false, and wants the stored database to be updated to reflect it.^ 

Definition 9. A request over a deductive database '3) is a pair = {S^t,'^ f), where 
S^t cind f are disjoint sets of facts requested to be true and false, respectively. □ 

To fulfill a request we need an update which, when executed, yields a database such 
that the view it determines satisfies the request. We call such updates weak repairs. 

Definition 10. Let S) = (j^, r\^P) be a deductive database and 5^ a request. An update 
U for ,f is a weak repair for ( 5^) if U fulfills that is, if for every a G S^t, 
v^a''^(a) = true and for every a S 5^ f, vgof^/(a) = false. □ 

We are primarily interested in updates that do not drastically change the database. 
One condition of being "non-drastic" is not to introduce new predicate or constant sym- 
bols. That leads us to the notion of a relevant weak repair 

Definition 11. Lef fF= {j^,'ri,P) be a deductive database and a request. A constant 
is relevant with respect to 3 and y if it occurs in or .y, or if it is _L. A predicate 
is relevant with respect to ^ and y if it occurs in or in y . A weak repair U for 
y) is relevant if every constant and predicate occurring in U is relevant. □ 

More generally, a weak repair is "non-drastic" if it minimizes the change it incurs 
[14]. There are two aspects to the minimality of change: (1) minimizing the set of 
new predicate symbols and constants introduced by an update to the database (in the 
extreme case, no new symbols must be introduced, and we used that requirement to 
define relevant weak repairs above); (2) minimizing the change in the truth values of 
facts with respect to the database. Following the Ockham's Razor principle to avoid 
introducing new entities unless necessary, we take the minimality of the set of new 
symbols as a primary consideration. To define the resulting notion of change minimality, 
we assume that the truth values are ordered false < unknown < true. Further, for a 
deductive database a request set y and an update U €^ we define NC{3,y,U) 
as the set of non nullary constants that occur in U and not in !3 and y. 

Definition 12. Let = {J^^rj) be a database with integrity constraints. For updates 
y,t/ e ^, we define U if: NC{&,y,U) C NC{3,y,V), or NC{3,y,U) = 
NC{!3,y,V) and for every hase atom a 

7. ifv^{a) = true, then v^owi'^) ^ v^o-fip) 

2. ifv@{a) — false, then v@oy(a) > v^o-wi^) 

3. ifvg{a) = unknown, then v^o'?/{a) = unknown orv yofia) = v^o'?/{a). 

We also define U \ZV if U andV gU. □ 

^ We do not allow requests that facts be unknown. That is, we only allow definite requests. While 
there may be situations when all the user learns about the fact is that it is unknown, they seem 
to be rather rare. In a typical situation, the user will learn the truth or falsity of a fact. 



We now define the classes of repairs and relevant repairs as subclasses of the re- 
spective classes of weak repairs consisting of their C-minimal elements. 

Definition 13. Let '2 — rj,P) be a deductive database and 5^ a request. A f relevant j 
repair /or is a \— -minimal (relevant) weak repair for □ 

We note that the existence of (weak) repairs does not guarantee the existence of 
relevant (weak) repairs. The observation remains true even if the view is empty. 

Example 6. Let & = {^,ri,P), where = (0,0), 77 = and P = {r ^ p{x),q{x)}. 
If the request is ({f},0), then each repair is of the form +q{i)'^}, for some 

i S Dom/j. None of them is relevant. (We note that {+p{±)'^, is not a (weak) 

repair The database resulting from the update would admit possible worlds of the form 
{pii),q{j)}, where / 7^ j. Clearly, the corresponding possible world of the view over 
any such database does not contain t and so the update does not fulfill the request.) □ 

Some relevant constants are not "forced" by the database and the request, that is, 
can be replaced by other constants. If such constants are present in a relevant (weak) 
repair, this repair is arbitrary. Otherwise, it is constrained. A formal definition follows. 

Definition 14. Let Qi = J] ,P) be a deductive database and ,5^ a request. A relevant 
{weak) repair U for [2!^S^) is constrained if there is no non-nullary constant a in U 
such that replacing some occurrences of a in U with a constant b ^ a (b might be _Lj, 
results in a weak repair for [S!, S^). □ 

Example 7. Let & = {.J',r],P), where J = ({/7(l),/z(2)},0), T] = and P = {f 
p{X),q{X); s r{X)}. Let us consider the request = ({i,f},0). The updates = 
{+^(l)^,+r(/)«}, / e {±,1,2}, and = {+^(2)«, +p(2)^, / e {±,1,2}, 
are relevant weak repairs. One of them, M^, is constrained. Indeed, replacing in 
the unique occurrence of a non-nullary constant (in this case, 1) with any other constant 
does not yield a weak repair On the other hand, Mi, i G {1,2}, and ; S {±, 1,2}, 
are not constrained. Indeed, replacing with 3 the second occurrence of 1 in M\, or the 
occurrence of 2 in R2, or both occurrences of 2 in M'- in each case results in a weak re- 
pair Also weak repairs = {+^(1)^, +r(/)^} and = {+q{2)'^ ,+p{2)'^ ,+r{i)'^}, 
! e {3, . . .}, are not constrained as they are not even relevant. □ 

We stress that, in order to test whether a relevant (weak) repair M is constrained, 
we need to consider every subset of occurrences of non-nullary constants in M. For 
instance, in the case of the repair .^1 = {q{l) , r{l)} from Example 7, the occurrence of 
the constant 1 in ( 1 ) is constrained by the presence of p{l). Replacing that occurrence 
of 1 with 3 does not result in a weak repair However, replacing the occurrence of 1 in 
r with 3 gives a weak repair and shows that ^1 is not constrained. 

Examples. Let Dow = {±, 1,2, . . .} and ^ = T],^}, where = ({^(l,2),i(l,2,3)}, 
<d),ri=Ql and P={p{X)^q{X,Y),r{X,Y,Z); r{X,Y,Z) ^ s{X,Y,Z),t{X,Y,Z)}. Let 
us consider the request ^ = ({/7(1)},0). In this case, our approach yields a unique 
constrained repair ~ {+r(l,2,3)^}. It recognizes that thanks to i(l,2,3) simply in- 
serting f (1,2,3) guarantees r(l,2,3) to be true and, consequently, ensures the presence 
of p{l) in the view. There are other repairs and other relevant repairs, but only the one 
listed above is constrained. □ 



We observe that every (relevant, constrained) weak repair contains a (relevant, con- 
strained) repair 

Proposition 2. Let S> ~ {J^ , "HtP) be a deductive database and 5^ a request. A (rele- 
vant, constrained) repair for (Ql ,5^) exists if and only if a (relevant, constrained) weak 
repair for {S!, 5^) exists. □ 

5 Complexity 

Finally, we discuss the complexity of decision problems concerning the existence of 
(weak) repairs of types introduced above. The results we present here have proofs that 
are non-trivial despite rather strong assumptions we adopted. We present them in the 
appendix. 

We assume that the sets of base and derived predicate symbols, the set of integrity 
constraints 77 and the view P are fixed. The only varying parts in the problems are a 
database and a request 5^. That is, we consider the data complexity setting. More- 
over, we assume that Dom = {±,1,2,...}, and take — and <, both with the standard in- 
terpretation on {1,2, . . .}, as the oyily built-in relations. We restrict integrity constraints 
to expressions of the form: 3X(\/Y{A\ A...AA|(.— >BiV... VB,„)), where A,- and Z?,- are 
atoms with no occurrences of _L constructed of base and built-in predicates, and where 
every variable occurring in the constraint belongs to X U 7, and occurs in some atom A,- 
built of a base predicate. 

We start by stating the result on the complexity of deciding the consistency of an 
indefinite database with integrity constraints. While interesting in its own right, it is also 
relevant to problems concerning the existence of repairs, as one of the conditions for U 
to be a repair is that the database that results from executing U be consistent. 

Theorem 1. The problem to decide whether a database , 77) has a possible world 
( is consistent) is NP-complete. □ 

We now turn attention to the problem of checking request satisfaction. Determin- 
ing the complexity of that task is a key stepping stone to the results on the complexity 
of deciding whether updates are (weak) repairs that are necessary for our results on 
the complexity of the existence of (weak) repairs. However, checking request satisfac- 
tion turns out to be a challenge even for very simple classes of views. In this paper, 
we restrict attention to the case when P is a safe definite (no constraints) acyclic (no 
recursion) Horn program, although we obtained Proposition 3 in a more general form. 

Proposition 3. The problem to decide whether a ground atom t is true in a deductive 
database (J^ ,7] ,P), where (j^, T]) is consistent and P is a safe Horn program, is in the 
class co-NP. □ 

Next, we consider the problem to decide whether a ground atom t is false in a 
deductive database (j^, rj,P). We state it separately from the previous one as our present 
proof of that result requires the assumption of acyclicity. 

Proposition 4. The problem to decide whether a ground atom t is false (ground literal 
-if is true) in a deductive database ^r\,P), where {j? ^r\) is consistent and P is an 
acyclic Horn program, is in the class co-NP. □ 



With Propositions 3 and 4 in hand, we move on to study the complexity of the 
problems of the existence of weak repairs. First, we establish an upper bound on the 
complexity of checking whether and update is a (relevant) weak repair 

Propositions. LefS— {j^,ri,P), whererj is a set of integrity constraints, P an acyclic 
Horn program, U an update and y a request set. The problem of checking whether an 
update U is a weak repair ( relevant weak repair) for S^) is in ^l". □ 

With the results above, we can address the question of the complexity of the exis- 
tence of repairs. The first problem concerns weak repairs and stands apart from others. 
It turns out, that deciding the existence of a weak repair is NP-complete, which may 
seem at odds with Proposition 5 (an obvious non-deterministic algorithm guesses an up- 
date U and checks that it is a weak repair apparently performing a "Zl" computation"). 
However, this low complexity of the problem is simply due to the fact that there are 
no relevance, constrainedness or minimality constraints are imposed on weak repairs. 
Thus, the question can be reduced to the question whether there is a "small" database 
^ , in which the request holds. The corresponding weak repair consists of deleting all 
elements from and "repopulating" the resulting empty database so that to obtain ^ . 

Theorem 2. Let = {^,ri,P), where rj is a set of integrity constraints, and P an 
acyclic Horn program, and let .y be a request set. The problem of deciding whether 
there is a weak repair for {S!,^) is NP-complete. □ 

As noted, the case of the existence of weak repairs is an outlier and deciding the 
existence of (weak) repairs of other types is much harder (under common assumptions 
concerning the polynomial hierarchy). 

Theorems. Let & ~ {y,r\^P), where r\ is a set of integrity constraints, and P an 
acyclic Horn program, and let y be a request set. The problems of deciding whether 
there is a relevant weak repair and whether there is a relevant repair for {!^^y) are 
1,2-complete. □ 

The last result concerns constrained (weak) repairs. It provides an upper bound on 
the complexity of the problem of deciding the existence of constrained repairs. We 
conjecture that the upper bound is in fact tight but have not been able to prove it. We 
leave the problem for future work. 

Theorem 4. Let Qi ~ (y^rj^P), where Tj is a set of integrity constraints, and P an 
acyclic Horn program, and let y be a request set. The problems of deciding whether 
there is a constrained weak repair and whether there is a constrained repair for (i^, y) 
are in E^. □ 

6 Discussion and conclusion 

We presented a declarative framework for view updating and integrity constraint main- 
tenance for indefinite databases. The framework is based on the notion of an indefi- 
nite deductive database. In our approach, the indefiniteness appears in the extensional 



database and is modeled by a single null value, consistent with the standards of database 
practice (a condition not followed by earlier works on the view-update problem over in- 
definite databases). We defined a precise semantics for indefinite deductive databases 
in terms of possible worlds. We used the framework to formulate and study the view- 
update problem. Exploiting the concept of minimality of change introduced by an up- 
date, we defined several classes of repairs, including relevant and constrained repairs, 
that translate an update request against a view into an update of the underlying database. 
Finally, we obtained several complexity results concerning the existence of repairs. 

Our paper advances the theory of view updating in three main ways. First, it pro- 
poses and studies the setting where extensional databases are indefinite both before and 
after an update. While introducing indefiniteness to narrow down the class of potential 
repairs was considered before [5], the assumption there was that the initial extensional 
database was complete. That assumption substantially limits the applicability of the 
earlier results. Second, our paper proposes a more expressive model of an indefinite ex- 
tensional database. In our model databases are determined by two sets of facts. The first 
set of facts specifies what is true and provides an upper bound to what might still be un- 
known. By CWA, everything else is false. The second set of facts lists exceptions to the 
"unknown range," that is, facts that according to the first set might be unknown but are 
actually false (exceptions). Third, our paper introduces two novel classes or repairs, rel- 
evant and constrained, that often substantially narrow down possible ways to fulfill an 
update request against a view. Relevant repairs do not introduce any new constants and 
minimize change. Constrained repairs in addition do not involve constants that are in 
some precise sense "replaceable" and, thus, not grounded in the problem specification. 

We already discussed some earlier work on view updating in the introduction as a 
backdrop to our approach. Expanding on that discussion, we note that the view-update 
problem is closely related to abduction and is often considered from that perspective. 
Perhaps the first explicit connection between the two was made by Bry [ 1 ] who pro- 
posed to use deductive tools as a means for implementing the type of abductive rea- 
soning required in updating views. That idea was pursued by others with modifications 
that depended on the class and the semantics of the views. For instance, Kakas and 
Mancarella [9] exploited in their work on view updates the abductive framework by 
Eshghi and Kowalski [4] and were the first to consider the stable-model semantics for 
views. Neither of the two works mentioned above was, however, concerned with the 
case of updates to views over indefinite databases. Console et al. [2] studied the case in 
which requests can involve variables. These variables are replaced by null values and, 
in this way, null values eventually end up in repaired databases. However, once there, 
they loose their null value status and are treated just as any other constants. Conse- 
quently, no reasoning over null values takes place, in particular, they have no special 
effect on the notion of minimality. None of the papers discussed studied the complexity 
of the view-update problem. Instead, the focus was on tailoring resolution-based deduc- 
tive reasoning tools to handle abduction. Some results on the complexity of abduction 
for logic programs were obtained by Eiter, Gottlob and Leone [3]. However, again the 
setting they considered did not assume incompleteness in extensional databases. 

Our paper leaves several interesting questions for future work. First, we consid- 
ered restricted classes of views. That suggests the problem to extend our complexity 



results to the full case of Horn programs and, later, stratified ones. Next, we consid- 
ered a Umited class of integrity constraints. Importantly, we disallowed tuple-generating 
constraints. However, once they are allowed, even a problem of repairing consistency 
in an extensional database becomes undecidable. A common solution in the database 
research is to impose syntactic restrictions on the constraints [8]. That suggests con- 
sidering view-updating in the setting in which only restricted classes of constraints are 
allowed. 
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Appendix 



Proposition 1. Let ^ be a database andq a fact. Then q G J^, if and only ifW \= q,for 
every W £ and qe J f if and only ifW ^ q,for every W € W {J). 

Proof: (1) Let q<E Jt and W G By Definition 3, we have that q G W^. Con- 

sequently, W ^ q. Conversely, let us suppose that for some atom q,W ^ q, for every 
W G W{^). We will show that q G J^. To this end, let us assume that q ^ J^*. 

Let q' G ,f. We will show that there is a definite fact q^ such that q' ^ q^i and q ^ q^. 
It is evident if q' and q are based on a different predicate symbol. Thus, let as assume 
that q' = p{si,. . . ,Sk) and q = p{ti, . . . ,tic), where all i, and f, are constants from Dom. 
If there is /, I < i < k, such that s, 7^ _L, f, ^ ± and 7^ r,, the claim is again evident. 
Thus, let us assume that for every /, 1 < i < k, Si = ±, or f; = _L or = f,. As q q' , 
there is /, \ <i <k, such that Sj = 1. and r, = c for some c G Dom \ {-L}. We define q^ 
to be any definite fact of the form p{u\, . . . , mj) such that q' < q^ and m; 7^ c (such facts 
exist as Dom is infinite). Clearly, q^i and the claim follows. 

We define V = {q^ \ q' e J}. By the definition, J C y*. Thus, J^, = J^* C y-'J'. 
Furthermore, by the way atom q^ were selected, V C ^1^. It follows that y is a possible 
world for On the other hand, y ^ ^, a contradiction. 

(2) Let q G J' f and let W G W{J'). If W ^ ^, then there is a definite atom qj G W such 
that q :< qd- Since W C there is an element q' ^ such that q' < qj. It follows that 
q^ q' and so, G J^~, a contradiction. Thus, W ^ q. 

Conversely, let us consider an atom q such that W ^ q, for every W G #'(^). Let 
us suppose that q G J^~. Then, there is a definite fact q^ G J^^ such that ^ ^ ^^y. Let 
y be the set of all definite facts in J^*. Clearly, C y* and y C J^^. Thus, y is a 
possible world for J^. Moreover, q^ G V. Thus, y ^ ^, a contradiction □ 

Proposition 2. Let Q = {J^ ,r\,P) be a deductive database and a request. A (rele- 
vant, constrained) repair for exists if and only if a (relevant, constrained) weak 
repair for J5^) exists. 

Proof: The "only if" part is evident. By the definition, a repair is a weak repair and, 
similarly, a relevant (constrained, respectively) repair is a relevant (constrained, respec- 
tively) weak repair 

For the "if" part, let us consider a weak repair U for (^,^). If y is a weak repair 
for and V ^U, then NC{&,y,V) C NC{&,y,U). It follows that the family 

of all weak repairs V such that y C [/ is finite. Thus, it has a minimal element, that is, 
it contains a repair for (f^,^). The argument for relevant (constrained, respectively) 
weak repairs is similar. □ 

Complexity results. In order to prove Theorem 1 we need some auxiliary definitions 
and results. We write size{S), for the size of the representation of S, where S stands for 
a deductive database, database, set of integrity constraints, etc. 

Lemma 1. If , rj) is consistent, then it has a possible world U such that \Dom{U) \ = 
0{size{y) + sizei-qj). 



Proof: If rj is empty then the claim trivially follows. Let us assume that T] Let W be 
a possible world for 77). We denote by C the set of elements from Donij that occur 
in {y , rj). Let us consider a constraint ^> G T]. It is of the form 

<P = 3X\/Y(p, 

where (p contains no quantifiers (we recall that (p is subject to the syntactic restrictions 
we imposed on integrity constraints), and X 7^ 0. Let us assume that X = {Xi ,Xj}. 
Since <P holds in W, we can select constants c* , . . . , c* G Dom {W ) so that the constraint 

0' =\fY(p{Xi/cu...,X,/cj) 

holds in W. Let C' be the set of all constants of the form cf, where <P ranges over all 
constraints in 77 that contain existential quantifiers. Clearly, |C'| = 0{size{ri)). 

Let rj' be obtained from 77 by replacing each constraint <P = 3XWY(p, where (p is 
quantifier-free and X 7^ 0, with the constraint <P'. It is clear that rj' consists of univer- 
sally quantified sentences and that W is a possible world for {J^,rj') (indeed, W is a 
possible world for and 77' holds in W). 

Let us now select a possible world V for {y,ri') so that \Dom{V) \ (CUC')| is 
minimal. As W is a possible world for {J^, rj'), V is well defined. 

Let c G Dom{V) \ (C U C') and let V' be the set of all atoms in V except for those 
that contain an occurrence of c. We have that 7j' holds in V'. Indeed, let f G 7]', say 
f = Vy^, where every variable in (p belongs to Y (and (p is an implication of the form 
specified above). Let (p' be a ground instance of (p (over Dorrid). If c does not occur 
in the consequent of <p' , then the truth values of the consequent of <p' in V and V' , 
respectively, are the same, while the truth value of the antecedent can only change from 
true to false when we move from V loV' . Consequently, the truth value of 9' remains 
true when we move from V to V' . If c occurs in the consequent of <p' , then it also occurs 
in the base atom in the antecedent of <p' . Thus, the truth value of the antecedent of <p' is 
false in V' {V' contains no atoms with an occurrence of c) and so, (p' is true in V' . 

It follows that V' is not a possible world for ^ (if it were, it would be a possi- 
ble world for (^,77') with \Dom{V')\{CUC')\ < |Dom(y) \ (CUC')|, a contradiction 
with the way V was chosen). Let ^ = {D,E). Since V' was obtained from V by delet- 
ing some of its atoms, every atom in E is false in V' as it was false in V. It follows that 
there is an atom A E D such that A is not true in V'. Since V is a possible world of J^, 

V \=A. Let us assume that A is definite. Then A G V and all constants it contains belong 
to C. Thus, A eV' and V' ^ A, a contradiction. It follows that A contains occurrences 
of _L. We assign to c that atom A. Let k be the number of occurrences of ± in A. Then, 
at most k constants in Dom{V) \ (CUC') can be assigned A. Indeed, in order for A to 
be assigned to a constant c G Dom{V) \ (CUC'), every definite instantiation of A in 

V must contain an occurrence of c (otherwise, removing all atoms with an occurrence 
of c from V would yield a possible world V in which A would be true). Let A' be any 
instantiation of A in V. If any of the constants assigned A does not occur in A', remov- 
ing that constant does not result in a possible world in which A is false. Thus, every 
constant assigned in A must occur in A', and the claim follows. Let a be the largest arity 
of a base predicate. Then, the number of constants in \Dom{V) \ (CUC')| is at most 
\D\xa — 0{size{J^)) (as a is fixed, due to the fact that the database schema is fixed). It 



follows that \Dom{V)\ < \Dom{V) \ (CUC')| + \C\ + \C'\ = 0{size{,y) + sizeirj)). □ 

Proposition 6. If {J^ , J]) is consistent, then it has a possible worldV such that sizeiV) ~ 
0{pol{ size{.y) + sizelrj))), where pol is some polynomial independent of ,r\). 

Proof: Let V be a possible world for Tj) constructed in the proof of Lemma 1. By 
Lemma 1, |y| < x {{size{^) -\- size^r]))" , where b is the number of base predicate 
symbols and a is the maximum arity of a base predicate (both numbers are fixed and 
independent of {j? , rj)). Without loss of generality, we can assume that all integers in 
V that do not appear in J]) are not larger than Max + 0{size{,f) + size{r])), where 
Max is the largest element from Dom^ occurring in ,f or Tj, or 0, if {,J^ ,"(]) contains 
no constants. Indeed, because of our restriction on built-in predicates, the only thing 
that matters is how those integers relate to each other with respect to — and <. Thus, 
all "gaps" among those integers in ^iV) that are larger than Max can be eliminated by 
"shifting" the numbers to the left. It follows that we can assume that the largest integer 
occurring in y is of size (9(s/ze(^) +i/ze(77)) and so, size{V) < \V\ xaxO{size{j^) + 
size{ri)) = 0{{size{j^) + size{'q)Y'^^). Since V' is a possible world for {J^, rj') it is also 
a possible world for rj). Thus, the assertion follows. □ 

For the argument above it is important that the database schema is fixed. For in- 
stance, if ^ = {{p{±, ±),^(_L),r(±)},0), where the arity of p is n and is not fixed, 
and W = {q{l) , r{2)} U {/?(«!, ... ,a„) | fl; G {1,2}}, then no constant can be removed 
from W, size{ J) = 0{n) and size{W) = 0{n2"). 

Theorem 1. The problem to decide whether a database {.y, rj) has a possible world (is 
consistent) is NP-complete. 

Proof: (Membership) Proposition 6 asserts that if (^,17) is consistent, then it has a 
possible world whose size is polynomial in size^^) -\- size{r]) . Thus, the following non- 
deterministic procedure decides the problem: First, the procedure guesses a set of facts 
W of size implied by the constructions from Lemma 1 and Proposition 6 (which is 
polynomial in size{J^) size(r\)). Next, the procedure checks that W is a possible world 
for J' and that it satisfies all constraints in ground{ri). Since both these tasks can be 
accomplished in polynomial time, the problem is in the class NP. 

(Hardness) The NP-hardness follows by a reduction from the 3-SAT problem to decide 
whether a quantified boolean formula = 3X (p is true, where X is a set of proposi- 
tional variables and ^ is a conjunction of 3-literal clauses over the set of atoms in X. 

Given such a formula <P, we assume that the domain Dom contains symbols true 
and false for representing the truth values, as well as symbols for representing atoms 
and clauses of the formula (p. With some abuse of the notation, we denote the sets of 
those symbols with X and CI, respectively. We assume that all those symbols are distinct 
and different from the domain elements 1, 2 and 3, which we use to represent positions 
of literals in clauses (for each clause we fix the order). 

Further, we assume that we have base predicate symbols val, sat, and occur. The 
predicates val and sat are binary. We use val to specify the truth value of atoms in X and 
sat to specify the truth value of clauses in CI (given the assignment of truth values to 
atoms as determined by val). Finally, the predicate occur is 4-ary. If an atom x occurs in 



a clause c ^Cl positively (negatively, respectively) in the position /;> e {1,2,3}, we rep- 
resent that by an atom occur{c, p,x,true) {occur{c,p,x, false), respectively). Clearly, 
all atoms of the form occur{c,p,x,v) uniquely determine the formula (p. We define 
= {D,(d) where D consists of: 

1. vaZ(x, _L), for each G X 

2. saf(c, _L), for each c G C/ 

3. occur{c,p,x,true), if x occurs positively in c in aposition p G {1,2,3} 

4. occur{c,p,x, false), if x occurs negatively in c in a position p G {1,2,3}. 

Next, we define Tj to consist of the following constraints (we note all of them satisfy 
the syntactic "safety" restriction we imposed): 

1. VA,y {val{A,V) ^true\/V = false) 

2. VA {val{A, true) Aval{A, false) ±) 

3. WC,V {sat{C,V) = tmeVV = false) 

4. VC (sat (C, true) /\ sat {C, false) — !■ L) 

5. VC,P,A,y {sat{CJalse) Aoccur{C,P,A,V) Aval{A,V) ^ L) 

6. yc,AA'A".y.y',y" 

{sat {C, true) A occur{C,l,A,V) A -^val{A,V) 
AoccMr(C,2,A',y') A-vfl/(A',y') 
AoccMr(C,3,A",y") A-vfl/(A",y") ^ L) 

7. VC {sat{C, false) — > _L). 

One can prove that <P is true if and only if (J^ ,ri) is consistent. □ 

Proposition 3. The problem to decide whether a ground atom t is true in a deductive 
database {J' ,r\,P), where ,r\) is consistent and P is a safe Horn program, is in the 
class co-NP. 

Proof: It suffices to show that the problem to decide whether f is not true in a deduc- 
tive database {y,rj,P) is in the class NP. That problem consists of deciding whether 
there is a possible world W of {^,ri) such that LM{PLIW) ^ t. If such a possible 
world W exists, the construction from the proof of Proposition 6 shows that there is 
a possible world y C W of the size polynomial in the size of y. Since y C W, we 
have LM{P\JV) ^ t. Thus, to decide that t is not true in {,J^ ,r\,P), one guesses V, a 
polynomial-size possible world for ( J^, Tj), and then verifies that it is a possible world 
for (J^, J]) and that t does not hold in it. These verification tasks are polynomial in the 
size of and so, the problem to decide whether t is not true in a deductive database 
{y,rj,P) is in the class NP, as required. □ 

Proposition 4. The problem to decide whether a ground atom t is false (ground literal 
-if is true) in a deductive database ,r\,P), where {j^ ,r\) is consistent and P is an 
acyclic Horn program, is in the class co-NP. 

Proof: To prove the assertion, we show that the complementary problem to decide 
whether t is not false in {.^ ,r\,P) is in NP. To this end, it suffices to show that if t 
is not false in {J^ ,rj,P) then there is a possible world V of {,f ,r\) such that the size of 
y is polynomial in the size of ^ and P\JV \=t. 



Clearly, if t is not false in {J^, ri,P), then there is a possible world W of {y , T] ) such 
that f U W 1= t. Let T be the tree of a shortest resolution proof of t from ground{PUW) 
and Wt the subset of atoms in W occurring in T. Let V be any subset of W such that 

1. {Wnj^,)LlWT QV 

2. V is minimal with respect to that requirement. 

In other words, for V we take any minimal subset of W that still "explains" the truth of 
every true atom of and contains all atoms Wt- We stress that there are many of these 
sets. We have the following properties: 

1. LM{P UV)^t (holds, as Wt C V) 

2. The size of V is polynomial in the size of y (follows by the fact that P is not 
recursive and T is a tree of a shortest proof, which implies that \Wt \ is bounded by 
a constant independent of the size of J^). 

As y is a subset of W, it may happen that some integrity constraints are violated. 
Specifically, it may now be that the body of an integrity constraint is true with respect 
to W, remains true with respect of V, and its head, which is true in W, becomes is false 
in y . In order to "fix" that constraints we reinsert into V atoms from W that make the 
consequent of the constraint true or, to be precise, a minimal set of such atoms. In this 
way, we obtain a new set, which we substitute for V . We continue this process as long as 
there are violated integrity constraints. The key point is that this process can only rein- 
troduce a polynomial number of atoms because the integrity constraints are safe (no 
existential quantification in the consequents) and the constants involved in the process 
are only those occurring in and in T. Therefore, when the process terminates, V is 
a possible world of ( J^, 77), its size is polynomial in the size of and LM{PlJV) ^ f . □ 

We believe that the result above can be extended to the case of (non-acyclic) Horn 
programs. However, a proof of such a result would have to follow a different approach. 
The reason is that given a possible world W for {J^ , 77) such that LM{P UW) \= t, it is 
not always possible to find a possible-world V 'ZW of size polynomial in the size of 
(^,77) such that LM{PUV) h t. Let = {{start{l),edge{±, ±)},Ql), 77 = and f 
consist of: 

r{X)^start{X) 

riX)^r{Y),edge{Y,X),r{X). 
Let us define t ~ r{0) and W = {start{l),edge{l,2),edge{2,3), . . . ,edge{n ~~ l,n), 
edge{n,0)}. Then W is a possible world for {-^ ,r]) andLM(PUW) ^ t. But W contains 
no fixed-size possible world V for (^,77) such that LM{P U V) |= f . Such a fixed-size 
possible world exists but has to be constructed independently of any particular possible 
world. 

Proposition 5. Let 'S = 77 where 77 is a set of integrity constraints, P an acyclic 
Horn program, U an update and ,5^ a request set. The problem of checking whether an 
update U is a weak repair for (i^,c5^) is in Zil"- 

Proof: Let ^' = (j^', 77,/" ), where J'' = J' oU An order to test whether is a weak 
repair we need to check whether is consistent and 2)' \= ,S^. Clearly, 2' can be con- 
structed in polynomial time. The first problem is NP-complete and so, can be solved by 



a call to an NP oracle (Theorem 1). The second one can be solved with a polynomial 
number of calls to coNP oracles (cf. Propositions 3 and 4). □ 



Theorem 2. Let 2! = {^,ri,P), where rj is a set of integrity constraints, and P an 
acyclic Horn program, and let ,5^ he a request set. The problem of deciding whether 
there is a weak repair for is NP-complete. 

Proof: (Membership) Let us assume that there is a weak repair for (i^, J^). It follows 
that there is an indefinite database ^ that satisfies the request. Let W be a possible 
world of Let a be an atom required to be true. Since ^ satisfies the request, there 
is a definite atom b such that a <b and b has a proof from PUW. Without loss of 
generality we may assume that the proof is minimal (no formula can be eliminated). It 
follows that the cardinality of that proof does not depend on ,f nor on ^ nor on 
It is so because P is acyclic and fixed (it is independent of the database component and 
of the request). Let Wa be the set of atoms from W occurring in that proof, Ca the set 
of all constants occurring in that proof and let W' and C be the unions of all sets Wa 
and Ca, respectively, over all atoms a required to be true. Finally, we define W" to be 
the set of all atoms in W that contain only occurrences of constants in C. It is clear that 
W' C W" C W and that the size of W" is polynomial in the size of 5^ . We will show 
that the request ,5^ holds in W" and that W" satisfies the integrity constraints. 

First, since W' C W" , P U W" ^ a, for every atom a requested to be true. Second, 
since for every atom b requested to be false, P U W ^ f U W" ^ b. Both properties 
follow from the fact that P is a Horn program and W' C W" C W . 

Next, we note that W" is obtained from W by removing from W all atoms that 
contain at least one constant not in C. Since W satisfies all the integrity constraints and 
since for every ground instance of an integrity constraint and for every constant that 
occurs in the consequent there is a base predicate in the antecedent with an occurrence 
of that constant, W" satisfies all integrity constraints, as well. 

To recap, we proved that if there is a weak repair for {S!,,5^), then there is a set 
of definite atoms W" built of base predicates such that the size of W" is polynomial in 
the size of ,5^, W" satisfies all the integrity constraints and P U W" ^ . Conversely, if 
such a set W" exists, then there is a weak repair for {S!,S^). Indeed, such a repair might 
be constructed of all update atoms needed to transform ,f into an empty database and 
all insert atoms converting that empty database into W" . Since W" is definite, W" is the 
only possible world of {W",r\,P) and by the properties ofW", (W",TJ,P) satisfies the 
request. 

It follows that the following algorithm decides whether there is a weak repair for 
guess a polynomial-size definite database W" and verify that it satisfies the 
integrity constraints and the request. Both checks can be performed in polynomial time. 
Thus, the problem is in the class NP. 

(Hardness) We prove the claim by a reduction from the 3-SAT problem. That problem 
consists of deciding whether a formula ^> = 3X (p is true, where X is a set of proposi- 
tional atoms and ^ is a CNF formula over X with each clause being a disjunction of 3 
literals. We denote the set of clauses in (p by CI. 

Given such a formula <P, we assume that the domain Dom contains symbols true 
and false to represent the truth values, and symbols to represent atoms and clauses of 



(p. With some abuse of notation we will denote those two sets of symbols by X and 
CI, respectively. We also assume these symbols are different from 1, 2 and 3, which 
we will use to denote positions of literals in clauses (we fix the order of literals in each 
clause). Next, we assume that we have base predicates val and occur. The predicate 
val is binary, and the predicate occur is 4-ary. We use val to define the truth value 
of a propositional atom in X. If an atom x occurs in a clause c positively (negatively, 
respectively) in a position p e {1,2,3}, we represent that by an atom occur{c,p,x,true) 
(occur{c,p,x, false), respectively). As derived predicates, we use predicates sat and 
occur'. The predicate sat is unary; we use it to represent the truth value of clauses in 
(p. The predicate occur' has the same arity and plays the same role as its non-primed 
counterpart. We define = (0,0) and 77 to consist of the following constraints: 

1. VC,P,A,A'V {occur{C,P,A,V) Aoccur{C,P,A',V) -^A^A') 

2. VC,P,A,y {occur{C,P,A,V) ^P = IVP = 2VP = 3) 

3. VC,P,A,y {occur{C,P,A,V) -^V =true'^V = false 

4. \/C,P,A {occur{C, P,A, true) Aoccur{C,P,A, false) ->■ _L) 

5. WA,V {val{A,V) =trueVV ^ false 

6. VA {val{A,true) Aval{A, false) — S> ±). 

Next, we define P to consist of the following rules: 

1. occur'{C,P,W,V) ^ occur{C,P,W,V) 

2. sat{C) i~ occur{C,P,W,V),val{W,V) 

Finally, we define the request set to consist of the following literals: 

1. occur' {c,p,x, true), for every clause c in <p, x & X and p G {1,2,3} such that x 
occurs positively in c in position p 

2. occur' {c^p^x, false), for every clause c m <p, x ^X and p e {1,2,3} such that x 
occurs negatively in c in position p 

3. sat{c), for every c G CI. 

One can prove that <P is true if and only if a weak repair for {2i, ,5^) exists. □ 

Theorem 3. Let 3l = {,J^,ri,P), where rj is a set of integrity constraints, and P an 
acyclic Horn program, and let be a request set. The problems of deciding whether 
there is a relevant weak repair and whether there is a relevant repair for (fF,^) are 
L2-complete. 

Proof: Firstly observe that there are only finitely many relevant weak repairs. Therefore, 
a C-minimal relevant weak repair exists if and only if a relevant weak repair exists. In 
the following we prove that the problem of deciding whether there is a relevant weak 
repair for (Sl^S^) is i^2'"Complete. 

(Membership) Each relevant weak repair for (^,^) consists of insert and delete ac- 
tions involving predicate symbols and constants occurring in and and the addi- 
tional constant ± representing the null value. Therefore, every relevant weak repair has 
size polynomial in the size of (f^, -5^). Once we guess a relevant update U , we have to 
test whether the updated database ^ o {/ is consistent, which can be decided by an NP 



oracle (Theorem 1), and whether the request is satisfied, which can be decided by poly- 
nomially many calls to co-NP oracles (Propositions 3 and 4). Thus, the membership of 
the problem in the class L2 follows. 

(Hardness) In order to show i^l'-hardness, we present a reduction from the problem to 
decide whether a quantified boolean formula <P = BXVY (p is true, where X and Y are 
disjoint sets of propositional atoms and 9 is a 3-DNF formula over the set of atoms 
Z U y. It is indeed sufficient, as that problem is known to be Z^'-complete. 

Given such a formula <P, we denote by Dtp the set of (identifiers of) disjuncts in 
(p. Clearly, each d E D^p is a conjunction of literals. We denote by (p^ the set of atoms 
that occur in d. We assume that the domain Dom contains symbols true and false, 
as well as symbols to represent atoms in X and in Y, and disjuncts of (p (elements of 
D(p). With some abuse of notation we will denote those sets of symbols by X, Y and 
D^, respectively. We assume that all these symbols are different from three additional 
domain symbols, 1, 2 and 3. We denote the set of all constants mentioned above by 
Dom,. That is, we set Donir = XUYUDcp U {1,2,3} U {true, false}. 

We assume base predicates inX, inY, disj, occur, inXc, inYc, disjc, occurc, valx, 
valy and assign. The predicates inX, inY are unary and their extensions give the sets of 
atoms X and Y . The predicate disj is also unary; its extension specifies the disjuncts 
of the formula <p. The predicate occur is 4-ary. If an atom a occurs in a disjunct d 
positively (negatively, respectively) in a position p G {1,2,3}, we represent that by an 
atom occur{d,p,x,true) {occur{d, p,x, false), respectively). The predicates with the 
subscript c have the same arities as their subscript-free counterparts and are intended 
to represent their complements with respect to Donir. The predicates valx, valy and 
assign are binary. We use valx and valy to specify the truth value of atoms in X and Y, 
respectively. The predicate assign will associate some new constants (not in Donir) with 
true and some other new constants with false (the need for that will became evident 
from the proof below). 

We also assume derived predicates q' for q G {inX, inXc, inY, inY^ disj, disjc, occur, 
occurc}, each of the same arity as its non-primed counterpart, as well as three additional 
ones val, sat and satisfied. The predicates q', q G {inX,inXc, inY, inYc, disj, disjc, occur, 
occurc}, allow us to formulate a request so that no relevant weak repair can change 
the extensions of the corresponding predicates in the database. The predicate val is 
unary and allows us to formulate a request that ensures that every possible world of the 
database resulting from a relevant weak repair assigns a truth value to every atom in 
XUY. The sat is unary and satisfied is propositional (0-ary). We use them to represent 
the satisfaction of individual disjuncts in (p and of (p itself. 

We now define the database y = {D,V>) where D consists of the following atoms: 

1. inX{a), for every atom a G X 

2. inY [a), for every atom a G F 

3. dis j{d), for every disjunct d G Dtp 

4. occur{d,a,p,true) for every atom a G X UF that occurs non-negated in position p 
in the conjunct d 

5. occur{d,a,p, false), for every atom a G X U F that occurs negated in position p in 
the conjunct d 



6. Finally, we include in D atoms inXc{a), inYc{a), disjc{d), occurc{d,a,p,v) so that 
the extensions of inXc, iriYc, disjc and occurc are the complements with respect to 
Donir (Domj, in the last case) of the extensions of the corresponding predicates as 
specified in (l)-(5). 

We define 7] to consist of the constraints: 

1 . VA , V {valx (A , y ) ^ y = true V y = false) 

2. VA {valx{A,t rue) Avalx{A, false) ±) 

3. \fA,V {valxiA,V) ^inX{A)) 

4. VB,y {valY{B,V) -> inY{B)) 

5. Vfi {valY{B,true) 1) 

6. MB lvahiBJalse) ^ L) 

7. VB \valY{B,l) L) 

8. VB (va/y(B,2) ^ ±) 

9. Vfi(va/y(B,3)^l) 

10. VB,A (/«X(A) A vfl/j'(B,A) _L) 

11. VB,A (/«y(A) A va/F(B,A) ^ _L) 

12. WB,D{disj{D)AvalY{B,D)^±) 

13. VB,y,y' (va/K(B,y) A vflZK(B,y') -> y = y') 

14. VB, y(vflZy(B,y) fliii§n(y,frMe) Vfliiig«(y,/flZie)) 

15. VB,y (va/y(B,y) AfliSig«(y,frMe) AflM!gn(y,/a/ie) — > _L). 

The view P consists of the following rules: 

1. g''(W) g'(W), for every base predicate q G {inX,inXc,inY,inYc,disj, disjc, occur, 
occurc} (W stands for a vector of different variable symbols of the appropriate 
arity) 

2. val{A) ^ inX{A),valx{A,V) 

3. va/(A) <- /«}'(A),vfl/y(A,y) 

4. iaf(D,P) ^occMr(D,P,A,y),/«X(A),vaZx(A,y) 

5. sat{D,P) i- occur{D,P,A,V),inY {A),valY{A,V'),assign(V' ,V) 

6. satisfied sat {D, I), sat {D, 2), sat (D, 3). 

Finally, we define the request set to consist of the facts: 

1. ^'(a), for every atom of the form ^(a) in ^ e {inX,inXc,inY,inYc,disj,discc, 
occur, occurc}). 

2. va/(A), foreveryA eXUF 

3. satisfied. 

We note that the part ( 1 ) of the request guarantees that no matter what relevant weak 
repair we consider, the extensions of base predicates inX, inXc, inY, inYc, disj, disjc, 
occur and occurc will be the same before and after the repair is applied. Atoms given 
in the specification (2) of the request guarantee that applying any weak repair results 
in a database that contains valx{-L, A-) or, for every a £X, valx{a,true), valx{a, false) 
or valx{a, _L). Since no constants present in the original database or in the request can 
be used as a in atoms of the form valY{y, a), it also follows that every relevant weak 



repair inserts into the database atom vfl/j'(_L,±) or, for every b atoms valyiy,!.). 
Due to the integrity constraint (14), it also inserts assign{±, ±) or assign{L,tme) and 
assign{JL^ false). 

We now prove that there exists a relevant weak repair for the database {&{^),,S^{<P)) 
if and only if ^' = BXVF (p is true. Let W be a set of propositional atoms. An assign- 
ment ©n/ of truth values to atoms in W determines a function &w{-), that takes as its 
argument a formula <p and returns the formula obtained by replacing in (p each w 
with a truth value {true or false). Given two assignments @x{-) and @y{), we define the 
function @x.y{-) = &x{&y{-))- 

(=>) Let be a relevant weak repair for the database (^(^>),^(^>)). Our goal is to 
derive from U an assignment &x such that for each assignment &y the truth value of 
@x,y{<P) is true. 

Let ^ ,f oU and x G X. By our discussion above, we have the following cases: 

1. ,f contains an atom of the form valx{x,true) (valx{x, false), respectively). In this 
case we set ©x{x) = true {©x{x) = false, respectively). We note that J^' cannot 
contain both valx{x,true) and valx{x, false) as that would violate one of the in- 
tegrity constraints. 

2. does not contain an atom of the form valx{x,true) or valx{x, false). Then, J^' 
contains valx{x, 1.) or valx{^, -L). In this case, the truth value ofX can be arbitrary 
and we set ©x{x) = true. 

We will now show that for each assignment ©y of truth values to atoms in Y, 
©x.y{(P) is true. By our discussion above, since U is a relevant weak repair, J^' contains 
the atom valY{-L,-L) or, for every y the atom va/}'(y, _L), and it also contains the 
atom assign{J-, 1.) or, the atoms assign(J-,true) and assign(J-, false). 

Let £,t and ^/ be domain elements not in Donir. We define 

W = yLi{valx{x,©x{x)) \xeX} 
U {valY{y,^t) \y G Y, 0Yiy) = true} 
U {assign{^t , true) , assign{^f, false) } . 

It is straightforward to check that W is a possible world of {J^',ri). Thus, satisfied 
holds in LM{P U W ) . Consequently, there is a disjunct d G D,p such that sat (d ) holds in 
LM{P\JW). It follows that &x,y{(P) = true. 

(<^=) Now, let us suppose that there is an assignment &x of truth value to atoms in 
X such that for each assignment &y of truth values to atoms in Y, the truth value of 
0x,f(<P) is true. We define U = {+valx{x,@x{x)) ,+valY{^-, 1-) ,assign{^-, 1)} . There- 
vised database J^' satisfies J^' ~ ^U{+vflZx(-«,0x(-^)),+va/)'(-L,-L),ass!g«(-L,-L)}. 
It is easy to check that r\) is consistent (we recall that {-^ ,T\) is consistent). 

It is clear that the parts (1) and (2) of the request hold after the repair We will prove 
that satisfied holds after the repair. Let us consider an arbitrary possible world W of 
{J^',ri). The integrity constraints imply that for every y G F there is exactly one atom 
valyiy, Cy) and exactly one atom assign{^y,v), where v = true or v = false. We define 
&Y SO that for every y €Y, &Y{y) = true if assign{^y,true) G W, and ©riy) — false, 
otherwise. Since 0x,f(<P) holds, there is a disjunct d G Dip such that 0x,Y{d) holds. 



Thus, sat{d) holds inLM(PUW) and so, satisfied holds mLM{P\JW), too. 



□ 



In order to prove Theorem 4 we need the following proposition. 

Proposition 7. Let '3 ~ (^,77,P), where rj is a set of integrity constraints, P an 
acyclic Horn program, U an update and ,5^ a request set. The problem of deciding 
whether an update U is a constrained weak repair for (2) ^ S^) is in iTl". 

Proof: By the definition to decide whether U is not a constrained weak repair we need 
to guess a non-nullary constant a and a subset Q of its occurrences and show that: 

1 . f/ is a weak repair for ,5^), and 

2. the update U' resulting from replacing occurrences of a in Q is a weak repair for 

Both tasks are in Zij (Proposition 5). Therefore, the problem of deciding whether U 
is not a constrained weak repair is in Zj" ™d the problem of deciding whether [/ is a 
constrained weak repair is in 7T|'. □ 

Tlieorem 4. Let & — ^r\,P), where rj is a set of integrity constraints, and P an 
acyclic Horn program, and let .y be a request set. The problems of deciding whether 
there is a constrained weak repair and whether there is a constrained repair for S^) 
are in T,^. 

Proof: Firstly observe that there are only finitely many constrained weak repairs. There- 
fore, a C-minimal constrained weak repair exists if and only if a constrained weak re- 
pair exists. In the following we prove that the problem of deciding whether there is a 
constrained weak repair for (^,^) is Zl'-complete. 

Each constrained weak repair is a relevant weak repair Therefore, its size is poly- 
nomial in the size of Si. Once we guess a relevant update U, we have to test if it is a 
constrained weak repair We know, by Proposition 7, that the second problem is in iTl". 
Therefore, the problem in the class NP^^ ~ E^. □ 



